Every helpdesk has lived some version of this morning. Patch Tuesday is still a week out, the browser update is “rolling out over the coming days,” and somebody in accounting clicked a link before their first coffee. By lunch you are pulling a laptop off the network and asking questions nobody enjoys answering. The Chrome-Windows zero-day exploit chain that researchers tied to the CLEANGULP backdoor this month is that morning, just run by state-aligned espionage groups instead of the usual commodity crowd.
The headline version going around says one browser bug owned the desktop. The real story is more useful and a little less cinematic: it took three separate bugs, two in Chrome and one in Windows, and the Windows piece only worked on older builds. That distinction matters a lot if you are the one deciding what to patch first.
Inside the Chrome-Windows Zero-Day Exploit Chain
Proofpoint published the most complete breakdown in its report on the BlueMoon exploit kit on September 9. According to Proofpoint, the kit chains:
- CVE-2026-85046, a type confusion bug in Chrome’s V8 JavaScript engine that gives the attacker read and write access inside V8’s heap.
- CVE-2026-87491, a V8 sandbox escape that overwrites WebAssembly compiled function bodies with shellcode.
- CVE-2026-85880, a Windows kernel local privilege escalation that Proofpoint says is present in older Windows builds and is used to escape Chrome’s renderer process.
Once the renderer is elevated, the kit injects a small stub into the parent Chrome broker process and runs whatever command the operator configured. By default, Proofpoint says, that is a curl command that downloads an executable and runs it. Proofpoint first saw the China-aligned actor TA412 using the kit on August 28, 2026, and within days it had spread to several other espionage-motivated clusters.
Microsoft’s advisory for CVE-2026-85880 describes it as a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) that allows local elevation of privilege, marks it as exploitation detected, and notes that an attacker running code in a low-privilege AppContainer could use it to escape the sandbox and gain SYSTEM privileges. That is exactly the job it does in this chain. The browser bugs get code running in a box; the Windows bug removes the box.
The Patch Gap Is the Real Villain
What makes this chain interesting to an operator is not the exploit engineering. It is the calendar. Proofpoint calls both V8 bugs “patch-gap” zero-days: the fixes were already public in upstream Chromium source, but the stable Chrome builds people actually run had not shipped them yet. For CVE-2026-85046, Proofpoint says the fix was committed on August 7 but did not reach the stable build until September 3, leaving a nearly four-week window in which the diff was public and the patch was not.
The second Chrome bug followed on September 8, when Google promoted Chrome 153 to stable. The Chrome Releases post lists CVE-2026-87491 as a Medium-severity out-of-bounds write in V8, buried among 230 security fixes, with the line “Google is aware that an exploit for CVE-2026-87491 exists in the wild.” Medium severity on its own, part of a chain in practice. Severity ratings describe a bug in isolation. Attackers do not use bugs in isolation.
In failover terms, this is a correlated failure. Each defense, the V8 sandbox, the renderer sandbox, and the OS privilege boundary, was supposed to be an independent layer. The chain lined up a hole in each one at the same moment, and the patch schedule made sure all three holes were open during the same window.
Where CLEANGULP Comes In
Volexity’s second write-up on the campaign, published September 21, describes a third Chinese actor it tracks as UTA0565 using the same chained exploits on September 3 and 4, while the vulnerabilities were still unpatched. Instead of links to obviously sketchy pages, UTA0565 used typosquatted sites that pulled real content from legitimate organizations, including a fake Center for American Progress site that loaded the exploit in an iframe.
The payload in that campaign was a previously undocumented malware family Volexity named CLEANGULP. Based on its analysis, Volexity says CLEANGULP installs itself to %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe, persists through a scheduled task named “MicrosoftIME,” and supports commands to run shell commands, list processes, upload and download files, and execute beacon object files. In plain terms, it is a foothold, and a foothold is all an espionage operator needs.
The detail I would tape to the SOC monitor is this one. Volexity says this variant replaced the earlier cmd.exe and curl download with code that fetches the file in-process, strips its Mark of the Web, and launches it through the Windows shell via COM. Proofpoint’s hunting guidance flags the default process tree of chrome.exe spawning cmd.exe, then curl.exe, then the payload. If your detection only watches for that tree, the CLEANGULP variant walks right past it. Attackers read the same blogs we do.
What the Headline Gets Wrong, and Why It Matters
“One browser bug owns the desktop” is the wrong mental model because it suggests a single patch fixes it and a single control would have stopped it. The opposite is true. Proofpoint notes that the Windows exploit only targeted older builds: Windows 10 1809 through 22H2, Windows Server 2019 and 2022, and the original Windows 11 21H2 release. Proofpoint also says the pairing of a current browser exploit with an old-Windows privilege escalation narrowed the pool of viable targets, and it read the whole operation as a rushed deployment rather than a polished one.
That is good news with an asterisk. If your fleet is on current Windows 11 builds, this particular chain lost its last stage. If you are still carrying Windows 10 machines because the replacement budget slipped again, and plenty of shops are, those are exactly the endpoints this kit was built to finish off.
The Helpdesk Checklist
- Force the browser restart. Chrome downloads updates quietly and applies them on relaunch. A patched binary sitting on disk behind a browser that has been open for three weeks protects nothing.
- Treat Chromium-based browsers as one fleet. Edge, Brave, and the rest share the V8 code. Inventory all of them, not just Chrome.
- Know your old-Windows footprint. The privilege escalation only worked on older builds. Your asset inventory should be able to answer “how many of those do we have” in minutes, not days.
- Hunt beyond the default process tree. Look for unexpected scheduled tasks, including one named “MicrosoftIME,” and executables landing in user profile folders shortly after a browsing session.
- Remember that patching is not remediation. Anything that ran before the fix shipped is still there after the fix ships.
Patch Tuesday will always be a little late for somebody. The goal is not to win every race. It is to make sure that when a chain like this lines up three holes, at least one of your layers is not where the attacker expected it to be.
Leave a Reply